Signup bursts and made-up emails: catching farm scripts at registration

Short answer

Group signups by time: on a site with a few dozen signups a day, three accounts from three different IPs within ten seconds of each other are not strangers, they are one script driving several phones. Then check the email domain: a domain without a dot, or one with no mail server, cannot receive the confirmation email, so nobody who wants their account back types it.

Signups in bursts

142 of 195 signups in 30 days came in bursts of 3+ phones within 10 seconds, each on its own IP.

Already caught by their devices

112 of those 142 accounts (78%), mostly cloud phones on one server GPU.

Emails that cannot exist

88 of the site's 236 accounts used a domain without a dot, and 8 domains had no mail server at all.

Every other site

Not one burst in 30 days, including a site with about 19 signups a day.

What one GPT site saw in October

The site is a GPT rewards site with offerwalls and PayPal, crypto and gift card cashouts, and about six genuine signups a day. In the second half of October its account list started growing in steps: three or four new accounts at a time, every few hours, each from a different US mobile or home IP.

Most of those accounts were already flagged by their devices. Their browsers named many different phones, from a Pixel 4 to a Galaxy S21+, but every one reported the same server graphics chip, the one used by rented Android containers (the cloud phone guide explains that tell). What the device check could not explain were the other thirty accounts: Pixel phones whose graphics chip matched the model, on US carrier IPs, clean by every device and network test.

Four accounts in five seconds, four different IPs, four believable phones, and four email domains typed by rolling a finger across a keyboard. The site never asked anyone to confirm their email, so nothing stopped them. Most of those accounts clicked offers and earned their first conversions the same morning.

Why signups in bursts give a script away

Real people arrive at random. On a site with six signups a day, the chance that three strangers on three different networks sign up within the same ten seconds is tiny: a coincidence like that happens far less than once a year. A script that drives several phones at once does it every run, because it fills the forms in parallel.

That is why the size of the site matters. On a big site with hundreds of signups a day, a promotion or a post can bring real users in waves, and bursts stop meaning anything. Below about a hundred signups a day they are a strong sign, and in our data they only showed up where a farm was at work: across every other site we watched in the same 30 days, including one with about 19 signups a day, there was not a single burst.

• Use the time of the browser visit to the signup page, not the time your server stored the account: some sites save signups in batches.
• Count only accounts on other IPs. Several accounts from one IP are a household, a class or one person, which the shared-IP and shared-device checks already weigh.
• Look at a window around each signup, before and after, so the first account of a burst is caught once the others arrive.
• Keep the window short. Ten seconds caught every burst on this site; a window of minutes starts to collect people who simply arrived close together on a busy evening.

-- Signups with two or more others from different IPs within 10 seconds
SELECT a.id, a.ip, a.created_at, COUNT(DISTINCT b.id) AS others
FROM signups a
JOIN signups b
  ON b.created_at BETWEEN a.created_at - INTERVAL 10 SECOND AND a.created_at + INTERVAL 10 SECOND
 AND b.ip <> a.ip
GROUP BY a.id, a.ip, a.created_at
HAVING others >= 2;

Email domains that cannot exist

The second mark was in the email field. 88 of the site's 236 accounts had an address like rthtyh@tyhjtyj: a domain with no dot, which no mail server in the world can receive mail for. Eight more domains had a dot but nothing behind it, such as a .vhy or .hdd ending. Across every other site we watched for 60 days, there was not one domain without a dot.

A real person mistypes now and then (gmailcom happens), so an address like this is evidence, not proof. But a domain that cannot receive mail on an account that never confirmed its email, signed up in a burst and went straight for the offers is the farm's signature.

function mail_domain_exists(string $email): bool
{
    $domain = strtolower(substr(strrchr($email, '@') ?: '', 1));
    if ($domain === '' || ! str_contains($domain, '.')) {
        return false; // no domain, or one without a dot
    }
    // Cache the answer per domain, and run it off the signup request.
    return checkdnsrr($domain.'.', 'MX') || checkdnsrr($domain.'.', 'A');
}

Neither is proof alone; together they are a farm

A burst can be a coincidence on a busy day and an odd domain can be a typo, so neither should block an account on its own. They are strong together, and stronger still next to the other evidence a farm leaves: a shared device, a cloud phone, the same payout address, offers completed faster than anyone could.

• A burst of new accounts from different IPs: hold their first cashouts for review.
• A burst plus made-up email domains: review every account in it, not only the one you noticed.
• A burst whose other members were caught by their devices: the rest of the burst is almost always the same farm.

How CashoutGuard does it

Since 31 October 2026 CashoutGuard adds two reasons on its own. signup_burst (weight 25) marks an account whose signup scan arrived within 10 seconds of two or more other accounts' scans from other IPs, on sites with fewer than 100 signups a day, and stays on the account's later events. email_invalid (weight 35) marks an address whose domain has no dot or no mail server; the mail server lookup runs in the background, never during the API call.

Alone, neither reaches the review threshold. Together they score 51, so the account is held for review on the default settings. On the site in this guide, applying both to the last two weeks of history moved 32 of its 71 accounts that were still allowed to review or block.